Nginx Proxy Manager VS crowdsec

I recently had trouble getting an SSL cert, but I found this PR and it already has an image and it works for me. I use Tailscale and my network isn't visible from the internet so I use the DNS Challenge option with GoDaddy and an API key.

I'm trying to use the react-express-mysql awesome-compose as a framework for setting up multiple react apps that are tied to the same domain. Once dev is complete, I update the Dockerfile for the frontend to add in Nginx and have Nginx serve the frontend so that it is not running using npm start. I additionally am using Nginx Proxy Manager as a reverse proxy to route where I need and manage SSL termination for me.

I ended up using the NGINX Proxy Manager [the projects home site] and added certificates but I'm seeing a fair number of installs going with https://traefik.io on YouTube.

Nginx Proxy Manager is a very easy and popular reverse proxy with a GUI.

Otherwise is the Nginx Proxy Manager a nice looking Reverse Proxy based on nginx with a GUI. I've been using it myself for a few years and experienced a few times some stability problems after updating with docker compose. Otherwise rock solid for me.

My reverse proxy does it automatically, NginxProxyManager.

Put on Debian or Ubuntu, using docker/docker-compose install Plex, Nextcloud (nice way to store your files), and some sort of reverse proxy like NPM.

Hey we actually built the second part as a product. Its a modern revamp of fail2ban combined with crowdsourcing aspect to deliver an up-to-date blocklist of active threats. You can check it out at https://github.com/crowdsecurity/crowdsec

This tool crowdsec.net is really interesting to mitigate and enact defense systems for different scenarios.

CrowdSec is licensed under MIT open source license, you can find a copy of the text here: “Copyright 2020, CrowdSec SAS (http://crowdsec.net), Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.” That’s all there is to it. Like in the case of Debian, you can do anything you want with it, for free, period. You just need to embed this license when you redistribute the product.

Do I need something like crowdsec, or is WireGuard secure enough on its own?

You could try out https://crowdsec.net. It’s an advanced FOSS framework for detecting a number of different attacks and not limited to just brute force attacks like Fail2Ban as /u/nonself suggests. The basic concept of CrowdSes is that it reads log, detects attacks, mitigates attacks (CrowdSec integrates directly into the Flask application) and shares information about those attacks with everyone else using CrowdSec. Disclaimer: I am head of community at CrowdSec so my opinions may be a little biased :-)

You need to setup reverse proxy. nginx-proxy-manager, swag. There are also more options like caddy, haproxy etc... You can also setup a VPN and or a service like authelia, fail2ban, crowdsec to restrict access to your site.

Release v1.4.1 · crowdsecurity/crowdsec (github.com)

Not what you suggested but have you considered https://crowdsec.net? Not just a collaborative and more advanced version of Fail2Ban but in this case you want it because of the collaborative blocklist; we made an article showing that 92% of attacks was blocked in advanced by ip reputation before any attacks were performed. Disclaimer: I am head of community so I might be a bit biased. It’s still a cool FOSS project though :-)

You need to look into reverse proxy. Most common one is nginx-proxy-manager which has a nice GUI. There is also SWAG. Both can been configured to get free SSL certificates. For security: authelia, fail2ban, crowdsec. I also suggest to configure wireguard, wg-easy. If you have any questions, we are here. Welcome and good luck!

So in that way everybody using CrowdSec are helping each other out. More information at https://crowdsec.net.